unkin/artifactapi
3
0
Fork 0
Code Issues 5 Pull Requests 11 Actions Packages Projects Releases 1 Wiki Activity

Add local puppet forge #145

Merged
benvin merged 3 commits from benvin/local-puppet into master 2026-10-17 13:17:52 +11:00
Conversation 2 Commits 3 Files Changed 9
+898 -3
unkin-agent commented 2026-10-16 23:37:05 +11:00
Member
Copy Link
Copy Source

Puppet modules can only be proxied from a remote Forge; there is nowhere to publish internal modules for puppet module install, r10k and g10k.

  • add puppet local uploads at --.tar.gz, rejecting existing versions
  • record each release's metadata.json, md5 and sha256 in a puppet_metadata table, streaming the tarball under size caps
  • serve Forge v3 /v3/modules, paginated /v3/releases, /v3/releases/ and /v3/files
  • add an e2e-docker case driving real r10k and puppet module install
  • document local puppet in README and UI usage snippets
Puppet modules can only be proxied from a remote Forge; there is nowhere to publish internal modules for puppet module install, r10k and g10k. - add puppet local uploads at <owner>-<module>-<version>.tar.gz, rejecting existing versions - record each release's metadata.json, md5 and sha256 in a puppet_metadata table, streaming the tarball under size caps - serve Forge v3 /v3/modules, paginated /v3/releases, /v3/releases/<slug> and /v3/files - add an e2e-docker case driving real r10k and puppet module install - document local puppet in README and UI usage snippets
unkin-agent added 1 commit 2026-10-16 23:37:06 +11:00
Add local puppet forge serving the Forge v3 API
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details
14303ae7ac
unkin-agent commented 2026-10-17 12:31:56 +11:00
Author
Member
Copy Link
Copy Source
  • internal/provider/puppet/local.go:229 — ?offset=9223372036854775807 makes offset+limit overflow and metas[lo:hi] panics (slice bounds out of range, reproduced) → clamp: lo := min(offset, len(metas)); hi := lo + min(limit, len(metas)-lo).
  • internal/provider/puppet/local.go:71 — AfterUpload io.ReadAll()s the whole tarball into memory with no cap, and parseModule walks the gzip stream via tr.Next() with no decompressed-bytes cap (gzip bomb burns CPU) → stream the blob, hash md5 via io.TeeReader, cap compressed size and bytes scanned (e.g. io.LimitReader on zr).
  • internal/provider/puppet/local.go:131 (nit) — a dir/symlink entry named metadata.json aborts the scan with a parse error instead of continuing → skip unless hdr.Typeflag == tar.TypeReg.
  • internal/database/puppet_metadata.go:27 (nit) — every /v3/releases page loads all rows and slices in memory → push LIMIT/OFFSET + COUNT into SQL.
- internal/provider/puppet/local.go:229 — `?offset=9223372036854775807` makes offset+limit overflow and `metas[lo:hi]` panics (slice bounds out of range, reproduced) → clamp: lo := min(offset, len(metas)); hi := lo + min(limit, len(metas)-lo). - internal/provider/puppet/local.go:71 — AfterUpload io.ReadAll()s the whole tarball into memory with no cap, and parseModule walks the gzip stream via tr.Next() with no decompressed-bytes cap (gzip bomb burns CPU) → stream the blob, hash md5 via io.TeeReader, cap compressed size and bytes scanned (e.g. io.LimitReader on zr). - internal/provider/puppet/local.go:131 (nit) — a dir/symlink entry named metadata.json aborts the scan with a parse error instead of continuing → skip unless hdr.Typeflag == tar.TypeReg. - internal/database/puppet_metadata.go:27 (nit) — every /v3/releases page loads all rows and slices in memory → push LIMIT/OFFSET + COUNT into SQL.
unkin-agent added 2 commits 2026-10-17 12:40:48 +11:00
Merge remote-tracking branch 'origin/master' into benvin/local-puppet 51886fc71c
Cap puppet tarball scan size and clamp release pagination
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details
d7178ee752
unkin-agent commented 2026-10-17 12:47:04 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit 9b91aa39a6 into master 2026-10-17 13:17:52 +11:00
benvin deleted branch benvin/local-puppet 2026-10-17 13:17:52 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/artifactapi#145
Delete Branch "benvin/local-puppet"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?